VARIABLE-STRTOE STREAM SEGMENTATION AND MULTI-PATTERN MATCHING BACKGROUND Field of the Invention The present invention relates to communication and computer networks, and, in particular, to use of variable-stride-block processing in multi-pattern matching for content-inspection system applications. Description of the Related Art This section introduces aspects that may help facilitate a better understanding of the invention(s). Accordingly, the statements of this section are to be read in this light and are not to be understood as admissions about what is or is not in the prior art. Multi-pattern matching is a key function used by content-inspection systems such as signature-based network-intrusion detection and prevention systems (NIDS/NIPS or NIDPS). Such systems depend on reliable real-time detection of specific signatures or patterns within network traffic to determine whether the traffic may potentially be harmful to the network or components of the network, including hosts. Typically, content-inspection systems may search for many such signatures concurrently. As line rates increase beyond 10Gbps, methods for efficiently handling multi-pattern matching have become increasingly important. Historically, pattern matching has been accomplished using a deterministic finite automaton (DFA). A DFA is a finite state machine where, for each state and input symbol, there is one and only one transition to a next state. Information on DFAs may be found in Gill, A., Introduction to the Theory of Finite-State Machines, McGraw-Hill, 1962, incorporated herein by reference in its entirety. In a basic type of DFA-based pattern matching, network traffic streams are processed one byte or character at a time. Such DFAs require n states to process n single-byte patterns and require t transitions per state, where t is the number of symbols in the pattern alphabet. However, processing one byte per clock at the line rates of modem networks is too slow. One way of improving upon the throughput of the fundamental DFA is by scanning multiple bytes (i.e., a block) of the input data stream in each matching step. While this block-oriented DFA approach provides a speedup relative to the byte-oriented DFA proportional to the number of bytes in a block, it presents other issues. In particular, since a pattern may start or end at any offset in a block, a block-oriented DFA may need either to (1) be repeated s times, where s is the block size or "stride" of the DFA, or (2) provide many more transitions per state. For example, in a first block-oriented DFA approach to pattern matching, patterns are divided into 5-byte blocks, and the blocks are used to construct the DFA. This results in a DFA with fewer states and transitions than a corresponding byte-oriented DFA for the same pattern. However, s instances of the DFA need to run in parallel, each accepting the same input data stream with an one-byte offset (to ensure that no patterns are overlooked). If the input stream is ...babbaba..., the sequence ...|ba|bb|ab|a... and its one-byte shifted version .. .b|ab|ba|ba|... both need to be processed to ensure that a match is not missed. With this approach, higher throughputs are achieved at the expense of higher memory-bandwidth usage (the result of running s instances of the matching engine in parallel), which memory-bandwidth needs grow in proportion to the block size s. Alternatively, one can build a single DFA for which the transitions account for all the possible s-byte patterns that can occur in the stream. By using a large- DFA, a single instance of the matching engine can be used to scan the input data stream without the possibility of missed matches. The throughput gain in this case is at the cost of higher memory usage, rather than higher memory bandwidth. Note also that the number of transitions from any state can be as large as t*, where t is the size of the alphabet. Indeed, for NIDS signature sets that use the English alphabet where t = 26, memory usage becomes prohiHtively high even for a block sizes of two bytes. Thus, a fundamental problem with existing pattern-matching approaches is excessive memory or memory-bandwidth requirements, particularly for systems that can run at the line-rate of current and anticipated network interfaces. SUMMARY In one embodiment, the present invention is a machine-implemented method for matching an input symbol stream to a symbol pattern. The input symbol stream is segmented into variable-size blocks of symbols to yield at least two input-stream segments of different lengths. Each of the at least two input-stream segments is compared with a pattern segment of the symbol pattern, wherein the pattern segment has fewer symbols than the symbol pattern. In another embodiment, the present invention is a machine-implemented method for segmenting an input symbol stream, k-grams of symbols within the input symbol stream are formed, where (k^0). A value is calculated for each k-gram. One or more special values are identified from the k-gram values within a sliding window of length w, where (k 2w-\-k-2, it is guaranteed that there is at least one core block for DFA construction. However, when w+k-2 w+k-l, the pattern becomes a coreless pattern which has only head and tail blocks. Patterns with length / < w+k-X have no delimiter at all and become indivisible patterns. The VS-DFA is not used for these short patterns directly because of the lack of core blocks. Instead, in various embodiments of the present invention, these patterns may be handled efficiently by a small ternary content addressable memory (TCAM). Ideally, the TCAM memory should have the same throughput as the state machine (i.e.,. one block per lookup cycle). To achieve this goal, a conventional method would duplicate the pattern multiple times, and shift each duplicate one byte with respect to the previous. However, the segmentation scheme of the present invention makes it sufficient to use only one TCAM entry for each coreless pattern. The TCAM entry is 2w+k-2 bytes in width. Each entry is partitioned into two sections, which are w bytes and w+h-2 bytes, respectively. To store a coreless pattern, its head block is aligned to the right of the first section and its tail block to the left of the second section. The unused bytes in the entry are masked as "don't care". No such optimization is done for indivisible patterns. Instead, max{w, w+k-2} TCAM entries are used for each indivisible pattern. Each entry covers a possible shift where this pattern can appear in the data stream. The first entry is left aligned with the TCAM entry. Each following entry shifts one byte toward the right side. An example is shown in FIG. 10. In this example, since w=A and k=2, the TCAM entry is 8-bytes wide. The coreless pattern "entire" segmented into "ent\ire", is stored in TCAM entry 1 as shown. The indivisible pattern "set" is spread across 4 TCAM entries. With this arrangement, to perform matches, the input stream is segmented as discussed earlier. One extra delimiter is added at the end of the byte stream. At each delimiter in the byte stream, w bytes are extracted before the delimiter, and (w+k-2) bytes are extracted after it. The combined string is then used as a key to query the TCAM memory. This approach is guaranteed to find the correct match for any short pattern. Short patterns, fortunately, are typically only a small fraction of the pattern set. Reducing Single-Byte Blocks VS-DFA's advantage in throughput is due to the relatively large average stride per DFA traversal step. For a random data stream, the expected block size is (vf+l)/2. However, certain input data streams processed by the segmentation algorithm as previously described may result in single-byte segments being produced independent of the chosen hash functions and window parameters. For example, processing an input stream with the same single character repeated consecutively may result in a series of single-byte segments. This may reduce system throughput and also make the system vulnerable to particular types of Denial-of-Service (DoS) attack. A low-entropy data stream may also be problematic for the previously described segmentation algorithm. Thus, in various embodiments of the present invention, an improvement over the hash value tie-breaker method is used to alleviate the problem of single-byte blocks appearing in segment streams and reducing effective system throughput. This is done by the application of one or two additional segment-combining rules. The resuhing enhanced segmentation process is used in various embodiments of the present invention: Combination Rule 1 (applied to segment streams): If more than one consecutive single-byte blocks appear in a data stream, then, starting with the first block, combine w single-byte blocks to form a new consolidated w-hyte block. The remaining blocks, if more than one, are also combined. For example, suppose w=4, and the consecutive single-byte blocks are |cl|c2|c3|c4|c5|c6| (assume the block before c1 and the block after c6 are longer than one byte). Applying the rule results in two combined blocks |clc2c3c4|c5c6|. Combination rule 1 eliminates all consecutive single-byte blocks, leaving only some isolated single-byte blocks dispersed between multi-byte blocks. In the worst case, where the single-byte blocks and double-byte blocks interleave with each other in a data stream, combination rule 1 provides a speedup factor of 1.5. A similar combination is also performed on the patterns. However, blindly combining the single-byte blocks in patterns may cause the segmentations on streams and patterns to lose their synchronization. The ambiguity occurs when the first or the last of several core blocks are single-byte blocks. Given different contexts (e.g., different prefix and suffix bytes), combination rule 1 may lead to different results. Thus, to ensure algorithm correctness, if the first one or more original core blocks are single-byte blocks, then they are no longer regarded as core blocks. Instead, they are pushed out as part of the head block. Likewise, special handling is also needed for the single-byte blocks neighboring the tail. Combination Rule 1 (applied to patterns): Combine all consecutive single-byte core blocks right after the original head block into the new head block. Combine the rest of the core blocks in the same way as described in combination rule 1 (applied on segment streams). After the combination, if the last core block is a combined one and it is shorter than w bytes, then combine it into the tail block. The following example illustrates combination rule 1 (applied to patterns). Assume pattern aaaaacbdddddabc is originally segmented as aaa|a|a|cbd|d|d|d|d{d|abc with w = 3. The first two single-byte blocks |a|a| should be combined with the head block. For the remaining blocks, the first three consecutive |d|s are combined into |ddd| and the last two consecutive |d|s are combined into |dd|. Since the block |dd|'s length is shorter than 3, it is combined with the tail block. Hence the new segmentation after applying the rule becomes aaaaa|cbd|ddd|ddabc. If, in another case, the same pattern is originally segmented differently as aaa|a|a|cbd|d|d|d|d|d|ab|c. After applying combination rule 1, the new segmentation should be aaaaa|cbd|ddd|dd|ab|c. The tail block remains the same because the last core block |ab| is not a result of combination. Combination rule 1 improves both the worst-case and the expected throughput. The downside of the combination is that patterns may have longer head and tail blocks. Moreover, some patterns may even become coreless patterns if all their core blocks are single-byte blocks before applying the rule. After the combination, the maximum tail block size can be (w+k-2)+{w-l) = (2w+k-3) bytes, since at most (w-l) single-byte blocks can be merged into the tail block. As for the head block, there is now no upper bound on the size. Since the algorithm needs to buffer the potential head blocks from the data stream for later matching verification, the size of the head blocks must be constrained. Fortunately, the number of patterns with their head blocks longer than w bytes is small. The issue is resolved by replicating the pattern vf times. Each replicated pattern is given a unique segmentation on the head block. The head-block segmentation procedure is as follows: Set the first delimiter after the ith byte, where (1≤/≤M'). After the first delimiter, a new delimiter is set after every w bytes. When the segmentation is done, the first block is kept as the new head block, and all the others are promoted to be core blocks. Each replicated pattern is then programmed in the VS-DFA as a new pattern, even though they still lead to matching the same stream segment pattern occurrence. For example, suppose the pattern Clc2c3c4c5c6c7c8c9cl0cll is initially segmented as Cl|c2|c3|c4|c5|c6|c7|c8c9cl0|cll with w=3. After applying combination rule 1, the segmented pattern becomes |clc2c3c4c5c6c7|c8c9cl0|cl 1. The new head block is even longer than 2w bytes. To constrain the length of the head block, the pattern is replicated three times and each receives a new segmentation as follows: |c 1 C2c3c4|c5c6c7|c8c9c 10|c 11, |clc2c3c4c5|c6c7|c8c9cl0|cl 1, and |c 1 C2c3c4c5c6|c7|c8c9c 10|c 11. Now no matter in which context the pattern appears in the input stream, it is guaranteed to be caught by one of the w segmentations. In summary, for patterns that have big head blocks after applying combination rule 1, the head block is constrained to be within 2w bytes at the cost of replicating the pattern w times. In some embodiments, the maximum head block size may be further constrained at the cost or using additional replicated patterns in that DFA. Eliminating Single-Byte Blocks Combination rule 1 eliminates all the consecutive single-byte blocks. However, the remaining isolated single-byte blocks may still slow down the processing. The worst-case throughput is 1.5 characters per step. Another rule, combination rule 2, may be used in various embodiments of the enhanced segmentation approach to eliminate almost all single-byte blocks. Combination Rule 2: After applying combination rule 1, combine every remaining single-byte block into its preceding block. For patterns, this only applies to core blocks. Also, since the first byte of the tail block might become a single-byte block in a data stream, replicate the pattern once and make a new segmentation to cover this case. For example, the pattern: |clc2c3|c4c5|c6|c7c8|c9cl0cll, becomes |c 1 c2c3 |c4c5c6|c7c8|c9c 10c 11 after the application of combination rule 2. However, in a data stream, the tail block of the pattern might be segmented as |c9|cl0cll, so combination rule 2, when applied to the data stream, may also result in the segmentation |clc2c3|c4c5c6|c7c8c9|cl0cll. Hence, both pattern segmentations should be inserted into the VS-DFA. However, in some cases, this replication is not necessary. For example, for the above pattern, if k=2 then the winnowing hash value is calculated at the position of c9 and c10. If the first value is greater than the second, then there will be certainly no delimiter between / and j, regardless of what characters appear after the pattern. In this case, no replication is done. Combination rule 2 prevents the DoS-attack problem and potentially increases system throughput. It also has other impacts on the system. The maximum block size now becomes (w+l) bytes. The patterns with long head blocks after applying combination rule 1 should be replicated (w+1) times accordingly. Although the combination rules may lead to some pattern replications, they do not necessarily increase memory consumption of the VS-DFA. On the contrary, they may actually help to lower memory consumption since single-byte state transitions are avoided. The combination rules as applied to input data segment streams to produce enhanced segment streams is illustrated in FIG. 11. Here FIG. 11(a) illustrates combination rule 1 applied to input data segment streams that resulted fi-om the application of the non-enhanced segmentation process. The process starts in step 1110. In step 1120, a series of segments are received fi"om a portion of the system responsible for preliminary segmentation of the input data stream. In step 1130, consecutive single-byte segments (blocks) are consolidated into w-byte segments, and in step 1140, each remaining set of consecutive single-byte segments is also combined into a single segment. What remains are orphan single-byte segments, separated from each other by at least one multi-byte segment. The process ends in step 1150. In FIG. 11(b), combination rule 2 is applied to the stream that results from the process of FIG. 11(a). In particular, the process starts in step 1150, and in step 1160, the stream that results from the application of combination rule 1 is received. In step 1170, every stray single-byte segment is consolidated into its preceding multi-byte segment. The process ends instep 1180. The present invention can be embodied in the form of methods and apparatuses for practicing those methods. The present invention can also be embodied in the form of program code embodied in tangible media, such as magnetic recording media, optical recording media, solid state memory, floppy diskettes, CD-ROMs, hard drives, or any other machine-readable storage medium, wherein, when the program code is loaded into and executed by a machine, such as a computer, the machine becomes an apparatus for practicing the invention. The present invention can also be embodied in the form of program code, for example, whether stored in a storage medium, loaded into and/or executed by a machine, or transmitted over some transmission medium or carrier, such as over electrical wiring or cabling, through fiber optics, or via electromagnetic radiation, wherein, when the program code is loaded into and executed by a machine, such as a computer, the machine becomes an apparatus for practicing the invention. When implemented on a general-purpose processor, the program code segments combine with the processor to provide a unique device that operates analogously to specific logic circuits. Alternatively or additionally, the invention or parts of the invention can be implemented in various forms, including without limitation, an application specific integrated circuit (ASIC) or field programmable gate array (FPGA). All of the aforementioned embodiments, whether processor, processor with software, ASIC, FPGA, stand-alone logic, or electronic or optical circuit should be understood herein to fall within the scope of the claims terminology of a "machine," and "machine-implemented" should be understood to include, without limitation, any of the aforementioned implementations as well as other implementation technologies that would be understood to be equivalent to those technologies by one skilled in the art. Unless explicitly stated otherwise, each numerical value and range should be interpreted as being approximate as if the word "about" or "approximately" preceded the value of the value or range. It will be further understood that various changes in the details, materials, and arrangements of the parts which have been described and illustrated in order to explain the nature of this invention may be made by those skilled in the art without departing from the scope of the invention as expressed in the following claims. It should be understood that the steps of the exemplary methods set forth herein are not necessarily required to be performed in the order described, and the order of the steps of such methods should be understood to be merely exemplary. Likewise, additional steps may be included in such methods, and certain steps may be omitted or combined, in methods consistent with various embodiments of the present invention. Although the elements in the following method claims, if any, are recited in a particular sequence with corresponding labeling, unless the claim recitations otherwise imply a particular sequence for implementing some or all of those elements, those elements are not necessarily intended to be limited to being implemented in that particular sequence. Reference herein to "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the invention. The appearances of the phrase "in one embodiment" in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments necessarily mutually exclusive of other embodiments. The same applies to the term "implementation." Although many of the examples in the foregoing discussion utilized English-language words and characters, an advantage of the segmentation scheme of the present invention is that it may be applied to any arbitrary input byte streams and/or byte patterns. Thus, the present scheme does not rely on semantic context of a stream to support segmentation. For example, while punctuation, whitespace, capitalization and/or other context elements that may be found in an English-language document may be used to delimit boundaries between multi-byte character strings found in such documents, the present invention does not require any such context-dependent system and thus has applicability to any arbitrary byte stream. Additionally, although the present invention is described in the context of data streams comprised of bytes of data, it is not restricted to octets of binary data. By way of example, if, instead of eight-bit representations of data, in an alternative representation of data, ten, twelve, or any other number of bits were used to represent symbols, then this invention would be equally applicable to the alternative representation. Thus, it is appropriate to say the present invention applies generally to any arbitrary input "symbol" streams. Further, in the same way, it is not necessary for these symbols to be specifically 8-bits in length, it is also not necessary that these symbols be restricted to a base two representation. Many of the foregoing embodiments have been illustrated using an exemplary winnowing function that incorporates a hash function and a minimum value filter to select special hash values fi-om jfc-grams within tiie input symbol stream. A hash function itself is an example of a class of functions known as one-way functions and the minimum value filter is an example of a class of filters or criteria that may be applied to a series of numbers to differentiate one from a set. In general, the present invention should not be limited by the examples of the embodiments but retain the full scope of the claims recited below as would be understood to one skilled in the art. CLAIMS We claim: 1. A machine-implemented method for matching an input symbol stream to a symbol pattern, the method comprising: (a) segmenting the input symbol stream into variable-size blocks of symbols to yield at least two input-stream segments of different lengths; and (b) comparing each of the at least two input-stream segments with a pattern segment of the symbol pattern, wherein the pattern segment has fewer symbols than the symbol pattern. 2. The method of claim 1, wherein step (a) comprises: (al) performing a one-way function on A:-grams of symbols within the input symbol stream to produce values associated with the A:-grams, where (k>0); (a2) filtering the values to identify at least one special value associated with at least one A:-gram; and (a3) delimiting the input symbol stream into at least two segments based on location within the input symbol stream of the at least one A-gram associated with the at least one special value. 3. The method of claim 2, wherein: the one-way function is a hash function; the values are hash values; the at least one special value is at least one special hash value associated with the at least one k-gram; step (al) comprises generating a plurality of hash values corresponding to a plurality of k-grams within a window of size w, where (kl). 10. Apparatus for matching an input symbol stream to a symbol pattern, the apparatus comprising: (a) means for segmenting the input symbol stream into variable-size blocks of symbols to yield at least two input-stream segments of different lengths; and (b) means for comparing each of the at least two input-stream segments with a pattern segment of the symbol pattern, wherein the pattern segment has fewer symbols than the symbol pattern.